Q39's repair 5 is a net, not a fence: live bytes and mtime are read around every
subprocess and around the subject's in-process import, a change restores the
bytes and refuses the run, so the write has already happened when the watch
fires. Q39's own record names the residual and the Q39 closure asks for "the
stronger form (the legs against a rewritten copy)". This is that form, and it is
the Helm lane's next unit rather than a new invention.
Three rules in the one choke point the gate already has -- the leg wrapper
installed on subprocess.run, so every future leg inherits them:
1. a subject leg carrying --dry-run runs AS THE ORIGINAL, watched: it writes
nothing by the collector's own rule (helm-collect.py:698), and running the
original is what lets the resolution leg read the subject's own destination
out of its banner;
2. every other subject leg, and the in-process import, runs the REWRITTEN COPY
-- every SNAPSHOT_PATH = assignment pointing at a per-invocation sandbox
built after admission and removed at the end of the run -- so module-level
code can write at most into the sandbox;
3. a subject leg is REFUSED (exit 2, the leg never runs) if its argv names the
live snapshot or passes --pin.
Rule 3 is load-bearing, not decoration: the collector refuses only when --out
resolves to its OWN SNAPSHOT_PATH (helm-collect.py:702), so a copy whose
destination is the sandbox would write the live path if a leg named it. The
gate's own "explicit live --out is refused" leg therefore now names the copy's
own destination -- the Q30 discipline applied to the collector. The rule under
test is unchanged; it is measured on a path that is not live, and the semantic
change is stated in the gate and the record rather than left implicit.
Measured, 20 gate invocations, live delta 0 on every one (snapshot 14,039 B /
aa842b0f... / mtime_ns 1791479579475780303; held pin 120 B / 5b6d7071... /
mtime_ns 1791478687099553071):
- green pair, 5 consecutive runs: rc 0, 166 passed / 0 failed, ALL GATES PASS,
12,248 B stdout; 4 subject legs redirected, 3 --dry-run legs run as the
original, 0 refusals; the sandbox holds 3 paths (the copy and its bytecode
cache, no data/snapshot.json); 18 legs watched, delta 0 on each;
- the five Q39 negatives refuse under BOTH gates (rc 2, stdout 0 B, no report
block, live delta 0) -- but they are refused at Q39's admission, before the
Q43 sandbox exists, so they are a regression control and nothing in the
five-fixture suite exercises the redirect. Stated, not hidden;
- the discriminator, on a scratch protected path: argvlive (the gate's own
pre-Q43 leg shape, rule 3 armed) -> rc 2, the refusal naming the leg's argv,
the copy's destination and the rule at :702, and the protected file's sha,
mtime AND ctime unchanged -- the leg never ran. argvlive-norule3 (rule 3
disarmed) -> rc 2 via Q39's watch, protected ctime MOVED while sha and mtime
were restored -- the leg ran, the copy wrote a real snapshot over the
protected file, and only the restore put it back. ctime_ns is the
discriminator: the stamp a restore cannot undo;
- the --pin residual: pin_stackchain() writes HELD_DIR, composed from HELM_HOME
and untouched by the rewrite, so a --pin leg is refused (rc 2, naming --pin
and /root/.helm/data/held); a copy with HELD_DIR also redirected to scratch,
run --pin --deploy, writes the scratch held file, so the path is real; bare
--pin is refused by the destination gate before `if args.pin`, so it is one
flag combination away, not on the default path;
- the rewrite is behaviour-preserving: original vs copy, both --dry-run, both
20,570 B, scrubbed over the gate's full clock set -> diff_keys [].
Three defects of mine, logged first in the record: the redirect keyed on argv[0],
which is the interpreter (the subject is an argv element, and the first run
measured 0 redirects while its legs ran the original -- the Q40 shape); the
behaviour-preservation scrub omitted generated_at and duration_seconds; and the
first --pin measurement ran bare, so the held path was never reached.
Limits stated in the record: prevention is total for the SNAPSHOT_PATH class, not
for every class; the legs still execute the subject's code, and damage to
anything other than the snapshot is out of this gate's scope; the five-fixture
suite no longer reaches Q43's machinery, so the two variants and the pin residual
are the coverage.
Nothing deployed: no cp into /root/.helm/bin/, the deployed bin is unmoved
(ee0b36a8... / 7ed1bca8... / 5c67473d...), decisions/ and inbox/ untouched, no
another-party file edited, no secret printed. Adoption stays Alexander's, and Q40
measured that the deployed gate has no subject-selection path at all, so the cp
is the only thing that puts any of Q31-Q43's protection into production.
Supersession note (2026-10-12): Merlin's full-population Q20 audit (9a1de9a, 269/269 literal, pipe-verified reply 20) closed Q20 while my two commits were egress-blocked; my sample verdict agreed. Audit file landed as recoveries/excerpt-placement-audit-zephyrus-sample.md (renamed on rebase so Merlin's deliverable at recoveries/excerpt-placement-audit.md is untouched).
Reproduces the Q39 closure's C26 from this host and states the mechanism:
`grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` -> 0; the deployed gate
imports its subject at module scope from a hard-coded path (`:39`), so the five
fixtures are never loaded -- the shipped gate has no subject-selection path at
all, which is why Q34-Q39's admission machinery has nothing in production to
guard. Measured: deployed gate x5 fixtures -> rc 0 / 7,488 B stdout /
`119 passed, 0 failed` / `VERDICT: ALL GATES PASS`, stderr 0 B, live snapshot
`aa842b0f...` delta 0 across all 15 invocations plus the green control; Q38
admits n1 and n2 (its C22/C23 holes); Q39 `9b09f328...` refuses all five
(rc 2 / stdout 0 B / no fixture file touched / live delta 0) and runs the pair
green (164 passed / 0 failed, `Q39 OK`, 17 legs watched, delta 0 on each).
Nothing deployed, no `cp`, `/root/.helm/bin/`, `decisions/` and `inbox/`
untouched. Deliverable `recoveries/helm-deployed-gate-admission.md` (5,633 B /
sha256 5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a).
Reproduces the Q39 closure's C26 from this host and states the mechanism:
`grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` -> 0; the deployed gate
imports its subject at module scope from a hard-coded path (`:39`), so the five
fixtures are never loaded -- the shipped gate has no subject-selection path at
all, which is why Q34-Q39's admission machinery has nothing in production to
guard. Measured: deployed gate x5 fixtures -> rc 0 / 7,488 B stdout /
`119 passed, 0 failed` / `VERDICT: ALL GATES PASS`, stderr 0 B, live snapshot
`aa842b0f...` delta 0 across all 15 invocations plus the green control; Q38
admits n1 and n2 (its C22/C23 holes); Q39 `9b09f328...` refuses all five
(rc 2 / stdout 0 B / no fixture file touched / live delta 0) and runs the pair
green (164 passed / 0 failed, `Q39 OK`, 17 legs watched, delta 0 on each).
Nothing deployed, no `cp`, `/root/.helm/bin/`, `decisions/` and `inbox/`
untouched. Deliverable `recoveries/helm-deployed-gate-admission.md` (5,633 B /
sha256 5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a).
Reproduces the Q39 closure's C26 from this host and states the mechanism:
`grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` -> 0; the deployed gate
imports its subject at module scope from a hard-coded path (`:39`), so the five
fixtures are never loaded -- the shipped gate has no subject-selection path at
all, which is why Q34-Q39's admission machinery has nothing in production to
guard. Measured: deployed gate x5 fixtures -> rc 0 / 7,488 B stdout /
`119 passed, 0 failed` / `VERDICT: ALL GATES PASS`, stderr 0 B, live snapshot
`aa842b0f...` delta 0 across all 15 invocations plus the green control; Q38
admits n1 and n2 (its C22/C23 holes); Q39 `9b09f328...` refuses all five
(rc 2 / stdout 0 B / no fixture file touched / live delta 0) and runs the pair
green (164 passed / 0 failed, `Q39 OK`, 17 legs watched, delta 0 on each).
Nothing deployed, no `cp`, `/root/.helm/bin/`, `decisions/` and `inbox/`
untouched. Deliverable `recoveries/helm-deployed-gate-admission.md` (5,633 B /
sha256 5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a).
Five repairs to the Q38 gate (74aba348 -> 9b09f328, +309/-38): the probe injects
from pathlib import Path so the rewritten line cannot NameError; EVERY SNAPSHOT_PATH
assignment is rewritten; a probe that dies with a traceback is refused; an ast scan
refuses an absolute path literal resolving inside /root/.helm/data/; and live bytes
and mtime are read around every subprocess and around the subject's in-process
import, a change dying the run and restoring the bytes it read.
Negative controls (q39-negatives.py, Q39-NEGATIVES.json): five fixtures, each run
under BOTH gates. n1 (the incident's shape) and n2 (a probe that dies with a
traceback) are ADMITTED by the Q38 gate - n1's in-process import writes the
fixture's destination inside the gate's own run - and refused by the Q39 gate.
Green pair: 5 consecutive invocations, rc 0, 164 passed / 0 failed, 17 legs
watched, live delta 0 on every run. Live snapshot aa842b0f delta 0 throughout;
nothing deployed, decisions/ and inbox/ untouched.
Q35's precondition reads a source marker (--deploy and SNAPSHOT_PATH.resolve() in the subject's
source), so a subject that documents the rule in a comment without implementing it is admitted —
the pipe measured exactly that at 02:4xZ today. The gate now, at helm-selftest.py:117-211, after
the Q35 check and before the subject import (:784) and G8's bare-refusal leg (:1079-1081, the Q34
incident's leg), runs a copy of the subject's source with its SNAPSHOT_PATH = assignment rewritten
to a sentinel path as a subprocess bare, and refuses the subject (exit 2, no leg runs) unless that
run exits non-zero, writes nothing, and leaves the live snapshot delta 0. The probe never imports
the subject into the gate's process.
Measured this run (scratch tree /root/crucible/q38/, nothing deployed):
- 7 consecutive green invocations, exit 0 each, 164 passed / 0 failed and ALL GATES PASS in every
log, the Q38 OK line present in all seven, live snapshot sha256+mtime read around every
invocation with delta 0 throughout.
- Discriminator on both sides: fake-documented-no-rule.py (both markers in its docstring, so the
Q35 predicate over its source is true) exits 2 with the refusal naming probe rc=0 and the
sentinel written (74 B / 817e3830...); fake-marker-only.py (the pipe's measured shape) exits 2 at
the assignment step; the deployed collector exits 2 at the Q35 source check with zero Q38 lines —
the ordering. The admission control: fake-marker-only.py under the Q35 gate runs G7 and dies at
the subject import (AttributeError, helm-selftest.py:688) — the admission measured end to end.
- Gate 1,044 -> 1,141 lines (+97/-0; DIFF.txt 108 lines / ac8e52bb...), sha256 643e5387... ->
74aba348...; collector byte-identical to the Q34/Q35 pair (4e45021d..., 720 lines).
- Live snapshot /root/.helm/data/snapshot.json 14,039 B / aa842b0f... / mtime_ns
1791479579475780303, delta 0 across every leg; deployed bin untouched (ee0b36a8 / 7ed1bca8 /
5c67473d); decisions/ and inbox/ untouched; no another-party file edited.
Section 4 consequence: the adoption pair is now collector 4e45021d... + gate 74aba348...
(superseding 643e5387...); the cp into /root/.helm/bin/ remains Alexander's.
The subject collector named by HELM_COLLECTOR is checked for the rule (--deploy and SNAPSHOT_PATH.resolve() in its source) at helm-selftest.py:96-114 BEFORE the subject is imported (:679) and before G1, and refused with exit 2, a stderr message naming the subject and the missing rule, and the live snapshot read before/after the refusal. Gate +61/-2 (985 -> 1044 lines, 45e53187 -> 643e5387); collector byte-identical to the Q34 pair (4e45021d); the precondition registers no check() so the suite count is unchanged at 164 and the old foot-of-suite source check is kept at :1032.
Seven consecutive green invocations (164 passed / 0 failed each, log digests in the deliverable), live snapshot delta 0 across every leg (aa842b0f / 14039 B / mtime_ns 1791479579475780303). Discriminator both sides in one run pair: deployed pre-gate collector as subject -> exit 2, stdout 0 bytes (e3b0c442, no summary and no PASS line, which is how "no leg executed" is measured), live delta 0; missing subject refused the same way, not crashed. Mechanism probe from this tree (q35-mechanism.py, mech-probe.log): default destination rebound to scratch, bare main() -- deployed ee0b36a8 rc=0 no refusal, 18523 B written (9331b218, schema helm.snapshot/1); pair 4e45021d rc=2, refusal naming the path and --deploy, nothing written.
Limits stated: the gate run bare now refuses itself (default subject is the pre-gate deployed collector; the section-4 cp is what makes the shipped gate green, Alexander's); the precondition reads a source marker, not behavioral proof; the rule protects the gate's legs, not a direct CLI run. Nothing deployed; decisions/ and inbox/ untouched.
- reproduced the defect first: python3 helm-render.py exits 1 with
NameError: name 'build_page' is not defined (guard at :90-91 above
def build_page at :232), same with --out, no file written
- moved the __main__ guard to the end of helm-render.py (:495 of 495);
--out/--as-of semantics unchanged; fixed renderer 21,766 B sha256
5c67473d89283c3d4434928dc96d45ff48a41d8f443ecc3c98e9236be8b597f9
- destination gate per the 09:21Z control-plane addendum: OUT_DEFAULT is
production, so main() resolves the destination and refuses without
--deploy (exit 2, message naming the path and flag); parse_args now
returns (out, now, explicit_out, deploy)
- gate G7: the CLI executed in a subprocess, asserting emitted bytes
(exit 0, file exists, bytes equal build_page()'s at the pinned clock,
byte count matches, --as-of honoured, live root untouched); production
destination refused by default and by explicit --out at the prod path
(resolve(), not string equality); --deploy branch exercised against a
patched OUT_DEFAULT; source-order guard so the defect cannot return
- gates re-run: 119 passed, 0 failed (102 before; G7 adds 17); the gate
discriminates - the same command against the pre-fix file exits 1
- CONTRACT.md appended append-only: transcripts, digests, gate, and a
revision note on :213-214 (deploy is now --deploy)
- nothing deployed: live page 9,865 B / 427b7b54c69b18d2... and snapshot
aa842b0fd88037f8... unchanged before and after every run; --deploy
alone never executed
recoveries/helm-render-aging.md — the served Helm page (9,865 B / sha256
427b7b54c69b18d270288910fc810732463129f48ec4bdd7dbc75cdb22997ce4, read
2026-10-11T08:53:51Z) carried five false FRESH badges and a "5 green" pill on a
snapshot 2d 15h 40m old, against its own rule "green = measured OK and fresh".
The honest reading was 0 green / 6 not green. The same page served
manifest_match: true while a fresh collect returns False (live
5e5cd6d26a700423... vs held f27326e8b13d1dec...). No Helm cron job exists.
helm-render.py now re-derives every badge from each source's own observed_at
against the collector's threshold table (imported, not copied), recomputes the
verdict, and stamps the page with its snapshot age, a STALE READING/CURRENT
banner naming the stalest source and its ratio, and a per-card evidence line
carrying the limit each reading aged past. --as-of pins the render clock.
Roster identity was filename_body.split("-")[0], which registers
zephyrus-sparkborn as two members; it is now the longest roster prefix, with
unrecognised bodies reported in troupe_standup.unrecognised_bodies rather than
silently attributed. Fresh collect: 4 members, unrecognised_bodies: [].
The site digest was unreproducible from outside: run() uses text=True, so
live_body_sha256 is over the CRLF->LF-normalised body. 217,162 wire bytes /
9a5ee1328d4a3fedd... vs 217,149 normalised / 5e5cd6d26a700423..., delta 13 = the
13 CRLF pairs, lone CR 0, raw.replace(CRLF,LF) == normalised. The snapshot now
records live_body_sha256_wire and names the rule; both reproduce via
curl | sha256sum and curl | tr -d '\r' | sha256sum.
helm-selftest: 102 passed, 0 failed, six gates. Three defects of mine are logged
first in the deliverable: (1) the first renderer ran at module scope, so
importing it overwrote the production page — reverted byte-exact from a pre-run
copy and re-verified; (2) build_page() referenced an undefined SNAPSHOT and
78/78 passed because nothing called it; (3) card() was passed the evidence
sub-dict instead of the source block, so no card printed its limit. A gate that
does not execute the path it protects is not a gate — G5 renders real HTML at a
pinned clock and asserts on the emitted bytes.
Nothing deployed: /var/www/alexander-whitestone/helm/index.html unchanged at
9,865 B / 427b7b54c69b18d2... throughout; staged pages live in
/root/crucible/helm/. Deploy is one command and Alexander's under section 4.
/root/.helm/data/snapshot.json not clobbered (aa842b0fd88037f8... before and
after). No secret printed; decisions/ and inbox/ untouched; no other party's
file edited; no X page fetched.
32 emit sites in build_blocks.py enumerated from the source (28 esc calls plus the 4
prose panels): 28 covered by fixture, 4 stated structural exclusions. 35 fixtures,
every negative exit 1 with 0 files written (4 valid-panel builds expand, 12
malformed-panel dies, 4 uncited dies, 10 non-panel field dies, 2 URL-field dies, 3
class-field dies, head/index/pager/gap/genesis, 1 no-token control).
URL-field scope decided: a token in a URL must die - safe_url rejects the non-https
body_source_url value, the pre-write sentinel scan catches the https-with-token and
excerpt cases, all exit 1 with 0 files.
The queue's scope clause closed with option (a): check_uncited() runs above OUT.mkdir
so all four token classes are pre-write (the uncited fixture wrote 20 files before the
patch, 0 after, same message).
No-token build still byte-identical at 91ecf6bf (125 files, diff -rq vs the shared
site-ledger silent). Shared tree untouched at 97fedb5d with blocks.json 63c9cee6; live
index 200 / 34,488 B / 4f764ef4dfb9. Patched builder c4127c6c is scratch-local,
nothing staged; decisions/ and inbox/ untouched.
Merlin
zephyrus-sparkborn
mercury
timmy